Demand-driven Alias Analysis Implementation Based on Open64

1. Demand-driven Alias Analysis Implementation Based on Open64 Xiaomi An annyur@gmail.com

2. Outline • Demand-driven alias analysis • CFL-Reachability based demand-driven alias analysis (DDA) • One-level flow demand-driven alias analysis (Olf DDA)

3. Why Demand driven? • Potential of faster analysis speed • Less memory requirement • Flexible framework to rebuild the lost info • Potentially support more aggressive analysis

4. Previous work on demand driven alias analysis • Heintze and Tardieu, Demand-Driven Pointer Analysis, PLDI 2001 • Sridharan and Bodik, Refinement-based context-sensitive points-to analysis for Java, PLDI 2006 • Xin Zheng and Radu Rugina, Demand-Driven Alias Analysis for C, POPL 2008 • Work for C • Answer alias queries without constructing points-to sets

5. Alias analysis via CFL-Reachability (1)—Program Representation • Graph representation of program (PEG) • Pointer dereference edges (D) • Assignment edges (A) • Corresponding edges in the opposite direction ( ) • Memory alias and value alias: • two l-value expressions are memory aliases, if they might denote the same memory location. • two expressions are value aliases, if they might evaluate to the same value.

6. Alias analysis via CFL-Reachability (2)—Hierarchical State Machine: Machine V: Machine M: Correspond to Andersen’s inclusion algorithm.

7. Alias analysis via CFL-Reachability (3)—Example Program: s = &t; r = &z; y = &r; s = r; x = *y; … = *x; *s = …; Program expression graph Analysis for query MayAlias(*x, *s)

8. Precision Evaluation (1) —Features of the demand-driven alias analysis (DDA) • Set-inclusion based • Field-sensitive • Flow-insensitive • Separate value flows for globals • May-alias

9. Precision Evaluation (2) —Typical test cases

10. Precision Evaluation (3) — Alias analysis results

11. Precision Evaluation (4) — Analysis and Conclusions • Result Analysis • For case (1) • DDA is better than AC due to set-inclusion • DDA is worse than FSA due to flow-insensitive and MAY-alias info • For case (2) • DDA is better than AC due to separate value flows for globals • DDA is better than FSA due to complete value flow tracking • For case (3) • DDA is better than AC due to field sensitivity, • DDA is better than FFA due to its keeping track of high level type info • Conclusions • Proper combination of good features leads to good precision. • DDA can replace AC without loss of precision.

12. Scalability Evaluation (1) —PEG features and alias queries classification • Open64, as an optimizing compiler, has large number of alias queries. • Quick disambiguation and caching are necessary. • Good alias analysis precision is necessary.

13. Scalabitlity Evaluation (2) — Results and Conclusion CFL-Reachability based alias analysis implementation doesn’t have good scalability.

14. One-level flow demand driven analysis(1)—Motivation • To avoid redundant graph traverse • To simplify the program expression graph • To get some of the scalability from union-based algorithm while keeping most of the precision from inclusion-based algorithm

15. One-level flow demand-driven analysis (2)—One-level flow hierarchical state machine Machine V: Machine M: Correspond to Das’s algorithm which lie between Andersen and Steengaard.

16. One-level flow demand-driven analysis (3)— New features • One-level inclusion-based, upper-level unification-based • Value flow factorization • Online incremental PEG simplification

17. One-level flow demand-driven analysis (4)— Example int foo () { int **p, **q; int *s1, *s2, *s3; p = &s1; p = &s2; q = &s3; q = p; *p = (int*) malloc(100); *q = (int*) malloc(100); return *s1 + *s2 + *s3; }

18. Scalability Evaluation (1) — Percentage of analysis finished

19. Scalability Evaluation (2) — Percentage of “not aliased” results

20. Conclusion and Future work • Conclusion • Demand driven alias analysis can be used in product compiler and give precise alias results. • One-level flow DDA can improve the scalability and give much more precise results for a reasonable compile time. • Future work • To extend demand driven analysis to inter-procedural analysis. • To exploit more methods to further improve scalability.

21. Thank You!